CrowdStrike: intrusions at law firms nearly doubled since 2023; Warp Panda used the VMware ESX logging bypass CISA just added to KEV as a zero-day, and Titan Panda went after law-firm billing software
CrowdStrike's report covers Sep 1, 2025 to Aug 31, 2026. Financially motivated groups made up 82% of activity against the legal sector, and 455 legal entities were named on leak sites, up 39% year over year.
- Chatty Spider: activity up 129% in the first eight months of 2026 versus all of 2024, with law firms nearly 90% of its victims. It impersonates IT staff to get remote sessions and in Nov 2025 hired a Russian national to walk into a US law firm posing as an IT employee. Snarky Spider and Cordial Spider use near-identical help-desk vishing and SSO-themed phishing.
- Warp Panda: deployed malware in vCenter environments and, as late as early 2026, exploited ESXi command-logging bypass CVE-2026-41709 as a zero-day. CISA added it to KEV on Oct 28 (due Nov 11).
- Titan Panda: in Apr 2026 exploited a hardcoded IIS machine key in Intapp Time Server, the first observed targeting of legal-specific software. Murky Panda's ORB28 password spraying hit 340+ mostly US entities, legal the most.
Take: the vishing pattern matches this week's Canadian Cyber Centre alert. Law firms should lock down help-desk resets, patch ESX to the builds in Broadcom's advisory, and check Intapp Time Server exposure.
Sources: CrowdStrike: 2026 Legal Threat Landscape Report, eCrime leads attacks, China activity intensifies (Oct 28) · CISA: Adds Two Known Exploited Vulnerabilities to Catalog (Oct 28)